CVE-2026-93188 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: roccat: bound device-supplied profile index
kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device
claiming the Roccat Kone id can send a switch-profile event (or a startup_profile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actual_dpi sysfs attribute.
Reject out-of-range indices in both paths.
This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel HID driver for Roccat devices contains a critical bounds checking vulnerability that allows an attacker to trigger out-of-bounds memory access through malicious USB input. Specifically, the functions kone_keep_values_up_to_date and kone_profile_activated utilize a profile index value supplied directly by the connected hardware device as an array subscript into the kone->profiles structure. This structure is statically defined with only five elements, yet the driver fails to validate that the incoming eight-bit integer falls within the valid range of zero through four before performing the memory access operation.
This lack of input validation creates a classic buffer over-read condition where a malicious USB device claiming the Roccat Kone hardware ID can exploit this flaw by sending a switch-profile event or triggering a startup_profile read during the probe phase with an arbitrary value outside the acceptable bounds. When such an out-of-range index is processed, the kernel attempts to dereference memory locations adjacent to the allocated profile array. This unauthorized access allows the attacker to leak sensitive kernel memory contents back through the actual_dpi sysfs attribute, effectively turning a driver logic error into a data exfiltration vector that can reveal internal state information or potentially aid in further exploitation efforts against the host system.
From a classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read and CWE-20 Improper Input Validation within the Common Weakness Enumeration framework. In terms of attack tactics, it corresponds to ATT&CK technique T1083 File and Directory Discovery or more specifically data exfiltration via peripheral devices if the leaked memory contains cryptographic keys or session tokens. The vulnerability was identified through static analysis techniques which flagged the unchecked array indexing pattern, and its exploitability was subsequently confirmed using KASAN slab-out-of-bounds testing within a KUnit test suite designed to simulate malicious device behavior during driver initialization and runtime profile switching operations.
To mitigate this risk, developers must implement strict range validation for all hardware-supplied indices before they are used as array subscripts or memory offsets. The fix involves adding conditional checks in both kone_keep_values_up_to_date and kone_profile_activated functions to reject any profile index that is less than zero or greater than the maximum valid index of four. This defensive programming approach ensures that only legitimate device commands proceed, thereby preventing unauthorized memory access regardless of whether the input originates from a compromised peripheral or a spoofed hardware signal. System administrators should apply kernel updates containing this patch immediately to close the information disclosure channel and restore the integrity boundary between user-space applications and kernel space data structures.